APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

According to a report by cybersecurity firm Sekoia, the Russia-linked advanced persistent threat group APT29 has been linked to a large-scale watering hole campaign targeting users of iOS and Android devices. The attack infrastructure leverages compromised websites and fake domains to deliver malicious payloads.

A key element of the campaign is a supply chain attack involving the Ukrainian web analytics service Plerdy SEO Tracker. Researchers indicate that injected JavaScript code associated with the service collects browser and device attributes. This collected data is used to facilitate the delivery of exploits targeting mobile operating systems.

The campaign is described as a watering hole attack, where users visiting compromised sites are exposed to the injected code. The involvement of APT29, a threat actor historically associated with Russian government interests, raises concerns about the sophistication and intent of the operation. The full scope of affected users and the specific exploits utilized remain areas of ongoing investigation.